This month, Drupal announced its plans for the end of life of Drupal 7. This has been pushed back a number of times over the past couple of years, partly due to the Covid pandemic, but it looks like Drupal now have a solid position.
Here is an excerpt from Drupal's statement:
"On February 23, 2022, we announced that we would be extending the End-of-Life for Drupal 7 until at least November 1, 2023. Today, we are officially announcing that Drupal 7 will reach its end of life on January 5, 2025. With this final extension, the Drupal Security Team is also adjusting the level of support provided.
*This will be the final extension."
Which on the face of it looks to be good news - support until 2025. However, they go on to say:
"Drupal 7 branches of unsupported modules are no longer eligible for new maintainership.
Community support for contributed modules will continue as it has to date. However, beginning August 1, 2023, once the Drupal 7 branch of a contributed module is marked unsupported it will not be eligible for new maintainership and will not be marked supported again. This will be true if an existing maintainer marks the module unsupported, or if the security team marks it unsupported for lack of response. If there are Drupal 7 modules that you or your clients rely on, then *we strongly encourage you to adopt these modules proactively."
So, while large-scale high-risk vulnerabilities for the core system will be covered, module support will rely on the continuing goodwill of maintainers. Any contributed module could find itself without a maintainer at any time - and with no prospect of a maintainer being restored. Any security flaws in such a module would go unpatched.
We are finding increasingly that Drupal 7 modules are becoming un-loved as the unpaid volunteers who create and maintain them concentrate more closely on their Drupal 10 versions.
So, What Now?
From the 1st of August it will become increasingly risky to maintain a Drupal 7 site of any complexity. We therefore recommend migrating away from Drupal 7 as soon as possible. While Drupal 7 is still a safe, secure platform for complex sites and e-commerce, it cannot be guaranteed to remain that way after August 1st.
While Drupal 7 is becoming obsolete, Drupal 10 has matured as a platform and is now ready to handle anything that could be done in Drupal 7 - and do it in a quicker, more modern way.
If you are interested in migrating from Drupal 7 to Drupal 10 please get in touch.